emcruise / tor-rootkit

A Python 3 standalone Windows 10 / Linux Rootkit using Tor.

tor-rootkit

A Python 3 standalone Windows 10 / Linux Rootkit. The networking communication get's established over the tor network.

This rootkit is WIP.

Disclaimer

Use for educational purposes only.

How to use

1. Clone the repo and change directory:

git clone https://github.com/emcruise/tor-rootkit.git
cd ./tor-rootkit

2. Build docker container:

docker build -t listener .

3. Run docker container:

docker run -v $(pwd)/executables:/executables/ -it listener

4. Deploy the executables: When the listener is up and running it generates a "executables" directory containing different payloads for different plattforms.

tor-rootkit/
│    ...
└    executables/

Note: The client can take some time to connect because PyInstaller executables are a bit slower and it need's to start tor.

Features

• Standalone executables for Windows and Linux, including python interpreter and tor
• the whole communication works over tor hidden services which guarantees some degree of anonymity
• The Listener can handle multiple clients
• The Listener generates payloads for different platforms on startup

Listener Shell Commands

Command	Explanation
help	Shows the help menu
^C or exit	Exits the shell
list	lists all connected clients with their according index
select <index>	start shell with client

Client Shell Commands

Command	Explanation
help	Shows the help menu
^C or exit	Exits the client shell and returns to listener shell
os <command>	Executes a command in the clients shell and returns the output
background	Keeps the connection to a client and returns to listener

Contribution

Any contributions are appreciated. Make a pull-requests and I'll merge if it passes my automatic tests.

tor-rootkit's Issues

build.py: torURL doesn't exist

I tried the project and ran into an error on the client side:

• The build.py tries to pull the tor expert bundle from "https://www.torproject.org/dist/torbrowser/10.0.12/tor-win32-0.4.5.6.zip"
• That URL does not exist, resulting in an error while trying to unpack: "Error while unpacking tor library"

Fix:

• change Line 15 in build.py to: torURL = 'https://dist.torproject.org/torbrowser/10.0.14/tor-win32-0.4.5.7.zip'
• The client works perfectly fine with that URL, even though it's a newer version of Tor than used before

Tor UPnP not necessary

UPnP not necessary

Windows client connecting with second process

I noticed when testing the tool that when running the rootkit the first process does absolutely nothing, but when I launch a second process while the first one is running the second one starts working. When later closing the first process, the second process ends the connection.

Client connection currently broken

I noticed yesterday, that the clients are not connecting to the listener since the last few commits in which I included the tor executable in the Linux client. I am working on fixing this Issue and introducing unit-tests to prevent issues like this in the future.

tor rootkit question

how do i install the tor rootkit client on the target machine? I will gladly be ready to support the project in any way I can if you help me.

please answer me by mail - [email protected] or you can write me an answer here

Build Error

build.py: error: unrecognized arguments: --add-data=torbundle;torbundle

this is not a rootkit, it's a reverse shell

A rootkit is supposed to have a multitude of built-in functions for post-exploitation. This project has none